In short: Lithune does not retain prompt or completion content and does not use it for model training. Limited technical metadata is processed to deliver, secure and account for the service.
1. Who is responsible
Levent Tuzun, a sole proprietor established in Türkiye and operating the Lithune brand, is the data controller for personal data whose processing purposes and means are determined by Lithune.
When the service is accessed through OpenRouter, OpenRouter also processes data under its own terms and privacy notice. OpenRouter's role is separate from Lithune's operation of the inference infrastructure.
For traffic routed by OpenRouter, Lithune authenticates OpenRouter's provider credential and does not receive or store the end user's OpenRouter API key, OpenRouter account identity or billing details.
2. Data we process
- Inference content: prompts, system messages, attachments and completions pass through Lithune systems and are processed transiently in memory by the model to generate a response. They are not retained by Lithune.
- Usage metadata: for successful public OpenRouter inference, an opaque identifier for the shared provider credential, timestamp, request count, prompt-token count, completion-token count and cached-token count. This is treated as pseudonymous personal data where it can be linked to a credential holder.
- Operational failure metadata: failure time, final status, producing layer, coarsened route and method classes, fixed cause and duration. It excludes prompts, completions, raw API keys, IP addresses, request IDs, media URLs, query strings and user agents.
- Web access logs: general public website and API access logging is disabled. The minimized failure outcomes described above are recorded separately.
- Website data: the public website does not use advertising cookies or analytics. Technical error logs may still be created when a server fault occurs.
- Support correspondence: if you e-mail Lithune, your e-mail address, name and the content of your message are processed to answer you.
Inference, usage and failure data is collected by automated means when a request reaches Lithune's API or website, including requests routed through OpenRouter and Cloudflare. Support correspondence is collected when you send Lithune an e-mail.
For public traffic routed by OpenRouter, Lithune records successful inference usage metadata against the shared provider credential presented by OpenRouter. Lithune does not receive the end user's OpenRouter API key, account identity or billing details, so these records do not identify an individual OpenRouter user to Lithune. Prompt, attachment and completion content may nevertheless contain personal data depending on what an OpenRouter user submits; Lithune processes that content transiently without retaining it.
3. Purposes and legal grounds
- To provide the requested inference response and administer API access: performance of the service relationship and processing necessary for that service.
- To verify usage and support billing or usage questions: performance of the service and Lithune's legitimate interest in accurate accounting. Per-request pseudonymous rows are used because aggregates cannot resolve an individual request-level discrepancy.
- To provide support, troubleshoot incidents, investigate abuse or security events and analyse capacity and reliability: Lithune's legitimate interest in operating a secure and reliable service. Less-identifying aggregates are used where the per-event record is unnecessary.
- To retain records required by applicable law: compliance with legal obligations.
Where Turkish Law No. 6698 applies, processing is carried out under the applicable conditions in Articles 5 and 6. Where the GDPR applies, the corresponding bases may include contract, legitimate interests and legal obligation.
4. Retention
- Prompt and completion content: not written to persistent storage by Lithune; discarded after response delivery.
- Successful inference usage records: limited to the latest 5,000 metadata records across the service and no more than 90 days old, whichever limit is reached first.
- Key-linked daily and rolling usage totals and exact last-use timestamps: retained for no more than 90 days. Credential records needed for authentication have a separate lifecycle.
- Privacy-minimized operational failure events and aggregates: up to 5,000 recent event rows and no more than 90 days; aggregate buckets expire after 90 days independently of that row ceiling.
- Operational and error logs: retained as described in the Data Policy.
- Support correspondence: kept only as long as needed to handle your request and any related follow-up, then deleted.
Ninety days is Lithune's purpose-based product maximum, not a general allowance under KVKK or GDPR. Cleanup runs on writes and at least daily, including after quiet periods or downtime. Controlled backups and exports follow the same deletion scope. A valid erasure or objection request is applied earlier where no overriding legal basis remains.
5. Recipients and data location
Model inference is performed on Lithune-owned hardware in Türkiye. Lithune does not send inference content to an external model or GPU provider.
Requests may be routed through OpenRouter and Cloudflare. Those organisations may process request, connection or account data for routing, security and platform operation under their own privacy terms, potentially outside Türkiye. Users should review those terms before using the service.
E-mail sent to Lithune passes through Cloudflare Email Routing and is stored by Lithune's e-mail provider.
6. Sensitive data
Users should not submit health information, biometric data, political opinions or other sensitive personal data unless they have a lawful basis and the submission is necessary. If included in a prompt, such content is processed transiently to produce the requested response and is not intentionally retained by Lithune.
7. Your rights
Depending on applicable law, including Article 11 of Turkish Law No. 6698, you may ask Lithune to confirm whether it processes personal data about you and, if so, to give you information about that processing; tell you the purpose of the processing and whether the data is used for that purpose; name the third parties in Türkiye or abroad to whom the data is transferred; correct incomplete or inaccurate data; erase or destroy the data; and notify those third parties of any correction or erasure. You may also object to a result against you that arises solely from automated analysis of your data, and claim compensation for damage caused by unlawful processing. Lithune does not receive OpenRouter account identities and may therefore be unable to associate technical usage metadata with an individual OpenRouter user. Requests may be sent to [email protected]. We may request sufficient information to verify the requester and will respond within the period required by applicable law.
You may also complain to Türkiye's Personal Data Protection Authority or, where applicable, your local data-protection authority.
8. Security and changes
Traffic is protected in transit using TLS, and access to infrastructure and retained metadata is restricted. Prompt and completion content is not written to persistent storage or used for training; derived KV-cache blocks may remain temporarily in volatile memory until eviction or service restart. No security measure can provide an absolute guarantee. Material changes to this notice will be reflected by updating the date above.